Exam CIPP-US All QuestionsBrowse all questions from this exam
Go to Exam
Question 21

SCENARIO -

Please use the following to answer the next question:

A US-based startup company is selling a new gaming application. One day, the CEO of the company receives an urgent letter from a prominent EU-based retail partner. Triggered by an unresolved complaint lodged by an EU resident, the letter describes an ongoing investigation by a supervisory authority into the retailer’s data handling practices.

The complainant accuses the retailer of improperly disclosing her personal data, without consent, to parties in the United States. Further, the complainant accuses the EU-based retailer of failing to respond to her withdrawal of consent and request for erasure of her personal data. Your organization, the US-based startup company, was never informed of this request for erasure by the EU-based retail partner. The supervisory authority investigating the complaint has threatened the suspension of data flows if the parties involved do not cooperate with the investigation. The letter closes with an urgent request: “Please act immediately by identifying all personal data received from our company.”

This is an important partnership. Company executives know that its biggest fans come from Western Europe; and this retailer is primarily responsible for the startup’s rapid market penetration.

As the Company’s data privacy leader, you are sensitive to the criticality of the relationship with the retailer.

Under the General Data Protection Regulation (GDPR), how would the U.S.-based startup company most likely be classified?

    Correct Answer: B

    Under the GDPR, the U.S.-based startup company would most likely be classified as a data processor. A data processor processes personal data on behalf of the data controller. In this scenario, the EU-based retailer is the data controller as it collects personal data and determines the purposes and means of processing. The U.S.-based startup, receiving personal data from the retailer and likely processing it according to the retailer's instructions, takes on the role of a data processor.

Discussion
Supp2023Option: C

"Data supervisor" is not a recognized term under the GDPR. The correct answer is C: as a data controller. The GDPR defines a data controller as the entity that determines the purposes, conditions, and means of the processing of personal data. In the given scenario, the US-based startup company is selling a new gaming application and would likely be considered a data controller as it determines the purposes and means of processing personal data of its users.

SavaageOption: B

The prompt says that the video game company received data from the retail, making it the Data Processor.

testaking917Option: B

Must be processor because they do not collect the data directly but the retailer does that

Robb17Option: B

Data processor

cpr14

So what's the correct answer?

BhimeshOption: B

The answer should be B: The controller is an EU-based retail partner and their letter says " The letter closes with an urgent request: “Please act immediately by identifying all personal data received from our company.”

Bhimesh

Correction - Option C

BM9904Option: C

Data controller is an organization that has the authority to decide how and why personal information is to be processed. This entity is the focus of most obligations under privacy and data protection laws

Buki007Option: C

Under the GDPR the company would be determined as a controller since they control the means and the use of the personal data that is collected and shared with their retail partner.

RomeoktonOption: C

Also think is C

jjjrbmOption: C

Correct answer is C. Data Controller

PrivacyICUOption: B

Processor is the answer and correct based on the fact that the EU retailer was collecting consents and sending data internationally to US. The distractor of lack of consent and the instruction somehow implied that it now needs to be adhered to by the processor despite controller EU Retailer messing up should be mindfully sidestepped. Supervisor and Controller are synonymous with both terms used in the GDPR. Data manager is not a term used in GDPR.

LisawoodOption: A

there is no data supervisor under GDPR

Testtaker719

Is the suggested answer valid although no equivalent role under GDPR but does apply to US?